Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm taking a course which is designed with the CISSP certification in mind. Though the class is categorized as software engineering, we talked a lot about physical security and, in particular, floods, fires, earthquakes and cars running into things. How is this security? For example we were told that data centres are safest in the middle of a building because if the roof was leaking the top wouldn't be safe, and water tends to go down so the lower floors would be the first to flood.

Is this really a security issue? For example, if the roof leaks the engineer would be at fault, not the security analyst. You wouldn't hire a security analyst to make sure the roof is solid.

UPDATE: Also, things like having bollards around a building to protect pedestrians from cars, how's this security? No one's really explained this yet. I was told the companies most valuable assets are their employees, but with this line of reasoning, what isn't security?

If the availability is so encompassing, what isn't part of security?

share|improve this question
3  
You quickly apply the physical security question to an "analyst". The CISSP is for higher level security folks than those at the analyst level. Do you want to know why the CISSP includes natural disasters or why an analyst should care? – schroeder Jan 10 at 16:35
8  
If the course is designed towards CISSP, then it is not a software engineering course. Information security includes paper records, personal security, availability of services etc – Rory Alsop Jan 10 at 16:58
4  
Do you really care what is attacking your data? Does it make a difference to you (and more importantly, to how you protect it) if someone is intentionally destroying your data center or if a natural weather phenomena is? – corsiKa Jan 11 at 7:13
9  
"if the roof leaks the engineer would be at fault" but if this results in any security problem, the security analyst is at fault. The goal is not to find someone to blame but to keep the resources available and secure. Your goal should be to have every possibility considered. If the roof leaks you should either have written somewhere that this is a risk the company is willing to accept or have mitigations. But in any case, it is your job to have considered it! – Josef Jan 11 at 8:25
2  
Of course they will make sure to have a good quality roof. But it is your responsibility as a security analyst to make sure the roof is good. With CISSP you ate not a computer guy. You are responsible for security and the roof, doors, walls... are part of that! – Josef Jan 11 at 9:00

All other answers are fine. I'm going to offer you a classic security perspective.

  • Starting a fire/flood is a textbook scenario for physical penetration/exfiltration. People under stress are less likely to challenge strangers.

  • A fire can be used to destroy forensic evidence, in particular when there's insider involvement.

  • An earthquake or, indeed, any natural disaster (like bush fires) is a potential complication for security because law and order break down and looting rears its ugly head.

  • Perimeter security against SVBIEDs is a necessary consideration in certain countries and threat environments. If a suicide car bomber can drive close to the walls of your data center, it is your failure as a security consultant. Hence bollards, flowerbeds, and concrete barriers.

  • Security is a holistic discipline. Every specialist cares about bits and pieces of the enterprise, and by necessity of life loses sight of the whole. There should be at least one person out there who thinks in terms of adversary's behavior and not his/her own pigeonhole. Which, incidentally, is a security consultant's job description.

share|improve this answer
16  
Especially strangers wearing yellow trench coats who came in with legitimate firefighters. – corsiKa Jan 11 at 7:14
    
I'm pretty sure that's such a common use case that it's even a tvtrope. But I don't want to get sucked into that hole so I'm not going to look for a link ;) – Wayne Werner Jan 13 at 0:57

It comes down to the classic security triad; Integrity, Confidentiality and Availability. The last of which could certainly suffer from any type of natural disaster, which is why you must include it in your continuity plan.

share|improve this answer
3  
Isn't that an overly pedantic view of availability? If there's someone using a computer that you need to be on, you wouldn't say that's a security problem. – Celeritas Jan 10 at 1:22
16  
@Celeritas: Sharing a computer with someone has a pretty low bar for security; availability isn't that critical in that situation. But if you're a company where your integrity and availability really are important, natural disasters could ruin you. Image if your bank flooded and they lost all your money (or you lost access to your money for a very extended period of time). Or imagine you're an email provider and a car crashes into your building: your users are going to be in trouble if that caused you to lose their data (or prevented access for a prolonged period). – Cornstalks Jan 10 at 3:54
4  
@ToddWilcox risks of integrity and confidentiality is very likely to be affected by your response to a natural disaster. For example, if some office or data center is physically unavailable due to a natural disaster, most companies will still continue working with confidential data and make sensitive financial decisions no matter what, even if the ordinary secure environment is unavailable, or some usually mandatory verifications are simply skipped because the needed data or systems are unavailable. You need to secure also your 'failover' process/procedures, not only business as usual. – Peteris Jan 10 at 21:13
4  
@Celeritas: The denial of service attack a common example of an availability issue in security. – Venge Jan 11 at 10:55
7  
@Celeritas: It's not "anything that hampers availability is a security issue". Amazon being a few seconds slower at Christmas is an acceptable degradation of service and therefore not a security issue; taking 600 seconds to serve a page is undoubtedly a denial of service for Amazon. Somewhere on the spectrum between 1 and 600 there comes a point where you stop thinking of it as slightly inconveniencing your customers and start thinking of it as losing your customers. – Eric Lippert Jan 11 at 14:09

CISSP is an information security certification not a computer security certification.

Information security is about the protecting the confidentiality, integrity, availabity of information in general. Information is not only stored on computers. They are printed out and stored in filing cabinets, they are memorized and stored in your employee's brains. Therefore, apart from ensuring that your computer networks are secure, you need to ensure physical security of your premises. If those confidential documents are stolen or destroyed in a disaster, it is also a loss of availability. If your employees sell the information to a competitor, then it is considered a loss of confidentiality. That is why policies and physical security measures are important.

share|improve this answer
1  
this makes more sense for me :) – Cerlin Boss Jan 12 at 5:18
2  
Exactly! CISSPs Job is to guarantee the security of the information. And if it leaks you can't dance around and play the blame game. It is your responsibility to guarantee the safety and if it fails it is your fault. That is why you get a nice compensation. – Falco Jan 12 at 12:54

Even if you take a narrow view of computer security as being limited to dealing with intentional malicious attacks, any way in which your system is vulnerable to a natural disaster also represents a way in which a well-equipped (or clever) attacker could disrupt your service. For example, if a data center is vulnerable to flooding, someone who wants to take it offline could cut a sprinkler pipe in the building. So it makes sense to protect against natural disaster scenarios as part of an overall security plan.

share|improve this answer

Disasters are as much a security issue as mitigating denial of service attacks. In the ISC2 (CISSP) docs, security is often represented by the CIA triad: Confidentiality, Integrity and Availability. Disaster recovery strategies and DDOS mitigation both pertain to establishing and maintaining availability.

share|improve this answer

I'll toss in my 2c and mention something that others have not specifically mentioned: Business Continuity Plans

BCP is an important function of a security analyst's job, and as such, the CISSP provides a broad overview of the issues that can impact disasters and outages. Knowing these high-level details helps the CISSP build a foundation for knowledge and the mindsets required to do BCP.

Please note that what is covered in the CISSP material is a broad, high-level overview of the topics. There is much, much more a Security pro needs to know and consider to properly create and manage a BCP program.

share|improve this answer

If we look in a dictionary one of the secondary meanings of "security" is:

the ​fact that something is not ​likely to ​fail or be ​lost

While we often think of Information Security as guards, guns, and hackers in dark glasses, what it is really about is protection of information from threats. These threats could be:

  • External attackers - hackers
  • Malicious insiders
  • Natural disasters
  • Technical problems - leaks, power outages
  • Honest mistakes - like losing a CD full of data
  • A lot more!

The reason CISSP covers all these is that an organisation needs someone to look after these issues. Turns out the sort of things you do to defend against the threats are pretty similar, so it makes sense to have one department take care of them.

share|improve this answer

I'm going to turn it around:

Disaster planning is not part of security, because security is part of disaster planning.

Disaster Planning, which is made up of Disaster Prevention and Disaster Recovery, covers a range of topics (e.g. redundancy, backups) including security.

share|improve this answer

Information security is about the protecting the integrity,confidentiality, and availability of information. Without being able to protect the information and make it available to those who require it even during a natural disaster could mean the end of a business.

I helped to develop Business Continuity Plans where one of the critical requirements was that certain information had to be (by law) available 24 hours a day, 7 days a week, 365 days a year. There was no allowed down time, even during a natural disaster such as a horrific earthquake.

There was no simple solution - business impact analysis had to be conducted. Information is not only being stored on computers. It is often scattered about and not just found in one centralized location. Identifying the critical information which is necessary to keep the business functioning is very tricky. Once the identification of critical systems and components is completed and reviewed. There is additional risk assessment which needs to take place.

During large natural disasters, such as earthquakes or large tornados, there is a high probability that the physical premises will be out of commission for some time. There were even examples where there was no building left or the team had limited access (15 to 20 minutes) to gather what was needed before no one would ever be allowed back into the building. Also, you could plan on some delays, because it had to be determined the buildings were sound enough for anyone to access them.

If it is a large disaster, where do you go or how is the continuity of operations accomplished. Local employees are certainly going to be affected by the disaster as well. It could be weeks before they are in any position to come back to work. In the case of one BCP I worked on, the employees were also faced with their homes being totally destroyed or they only had a few minutes to enter their homes and gather up belongings. Many told me they grabbed clothes and toothbrushes, and identification documents and had to leave other personal items behind.

So part of the technical strategy can be developing a multitude of options depending on the Risk Assessment. There can be plans for cold sites, warm sites, and hot sites depending on the budget. Strategies for protecting identified critical servers and hardware with RAID, clustering, and load balancing, focusing on fault tolerance. Of course, there is protection of data through backs up and plans for restoring critical data and having it available to be utilized by the cold sites, warm sites, and hot sites, ensuring confidential documents are protected and available to those who require the information at all times.

Once in place, all of these strategies, plans, and policies need to reviewed, maintained, and verified. It requires a lot of personnel to be involved and to be aware. The one constant thing is change. New hardware and software solutions are being implemented. Business requirements and laws are being modified. I can certainly understand why it is mentioned. Information security is about the protecting the integrity, confidentiality, and availability of information.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.